An authentication bypass exists in `oauth-token.service.ts` where Proof Key for Code Exchange (PKCE) is incorrectly treated as a substitute for confidential client authentication. This causes the system to skip client secret verification when the secret is omitted. An attacker who has captured an authorization code and the PKCE verifier can generate access tokens and 60-day refresh tokens for a confidential client without possessing the required client secret.